Sigma rule: Unsigned .node File Loaded

Rule

Title

Unsigned .node File Loaded

Status

experimental

Level

medium

Author

Jonathan Beierle (@hullabrian)

Date

2025-11-22

Modified

2026-08-27

File

rules/windows/image_load/image_load_dll_unsigned_node_load.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the loading of unsigned .node files.
Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack.
.node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code.
This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.

Log source

product

windows

category

image_load

Detection

selection_node_extension:
    ImageLoaded|endswith: '.node'
selection_status:
    - Signed: 'false'
    - SignatureStatus: 'Unavailable'
filter_optional_vscode_jupyter:
    Image|endswith: '\Code.exe'
    ImageLoaded|contains: '.vscode\extensions\ms-toolsai.jupyter-'
    ImageLoaded|endswith:
        - '\electron.napi.node'
        - '\node.napi.glibc.node'
filter_optional_vscode_core:
    Image|contains: '\Microsoft VS Code\Code.exe'
    ImageLoaded|contains: '\Microsoft VS Code\resources\app\node_modules'
filter_optional_evernote:
    Image|contains:
        - 'C:\Program Files (x86)\'
        - 'C:\Program Files\'
        - '\AppData\Local\Programs\'
    Image|endswith: '\Evernote\Evernote.exe'
    ImageLoaded|contains: '\Evernote\resources\app'
condition: all of selection_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• VsCode extensions or similar legitimate tools might use unsigned .node files. These should be investigated on a case-by-case basis, and whitelisted if determined to be benign.

Tags

• attack.execution
• attack.privilege-escalation
• attack.persistence
• attack.stealth
• attack.t1129
• attack.t1574.001
• attack.t1036.005

MITRE ATT&CK ids this rule names

• T1036.005
• T1129
• T1574.001

References

• https://www.coreycburton.com/blog/driploader-case-study
• https://github.com/CoreyCBurton/DripLoaderNG
• https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_dll_unsigned_node_load.yml